Analysis
-
max time kernel
135s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 18:34
Static task
static1
Behavioral task
behavioral1
Sample
ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe
Resource
win10v2004-20220812-en
General
-
Target
ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe
-
Size
193KB
-
MD5
e05eeee6d2bdf27d5dc83910ac7ca93b
-
SHA1
c1985c15c8a4f84928e7832041c86b6d089c14fc
-
SHA256
ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790
-
SHA512
c152327a1e9dff584b7a2ff0fae2a5ed6444c69ada6a6a6b862e62103c36c09b8647f84806f97fc3cfa59bd470a8c0d209df95de02891d11241bde826e181afc
-
SSDEEP
3072:OzA2AJKoClrGvNPuCGYR69X3wKvzNVL58ACjOJBfgPV+Muce:Ogs3YR65nVTtyPVBe
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1428-64-0x0000000000400000-0x0000000004CC8000-memory.dmp cryptone behavioral1/memory/860-65-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1240-71-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1240-72-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1240-73-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1428-91-0x0000000000400000-0x0000000004CC8000-memory.dmp cryptone behavioral1/memory/860-92-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exenotepad.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jdklku = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\Jdklku.exe" notepad.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exenotepad.exedescription ioc process File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\D: notepad.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\S: svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exedescription pid process target process PID 1428 set thread context of 908 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
svchost.exeab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exepid process 860 svchost.exe 908 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exepid process 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exesvchost.execalc.exenotepad.exedescription pid process Token: SeDebugPrivilege 908 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe Token: SeDebugPrivilege 860 svchost.exe Token: SeDebugPrivilege 1632 calc.exe Token: SeDebugPrivilege 1240 notepad.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exesvchost.exeab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exedescription pid process target process PID 1428 wrote to memory of 860 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe svchost.exe PID 1428 wrote to memory of 860 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe svchost.exe PID 1428 wrote to memory of 860 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe svchost.exe PID 1428 wrote to memory of 860 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe svchost.exe PID 1428 wrote to memory of 1632 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe calc.exe PID 1428 wrote to memory of 1632 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe calc.exe PID 1428 wrote to memory of 1632 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe calc.exe PID 1428 wrote to memory of 1632 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe calc.exe PID 1428 wrote to memory of 1632 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe calc.exe PID 1428 wrote to memory of 860 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe svchost.exe PID 1428 wrote to memory of 1632 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe calc.exe PID 860 wrote to memory of 1240 860 svchost.exe notepad.exe PID 860 wrote to memory of 1240 860 svchost.exe notepad.exe PID 860 wrote to memory of 1240 860 svchost.exe notepad.exe PID 860 wrote to memory of 1240 860 svchost.exe notepad.exe PID 860 wrote to memory of 1240 860 svchost.exe notepad.exe PID 1428 wrote to memory of 908 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe PID 1428 wrote to memory of 908 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe PID 1428 wrote to memory of 908 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe PID 1428 wrote to memory of 908 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe PID 1428 wrote to memory of 908 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe PID 1428 wrote to memory of 908 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe PID 1428 wrote to memory of 908 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe PID 1428 wrote to memory of 908 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe PID 1428 wrote to memory of 908 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe PID 1428 wrote to memory of 908 1428 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe PID 908 wrote to memory of 860 908 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe svchost.exe PID 908 wrote to memory of 860 908 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe svchost.exe PID 908 wrote to memory of 1632 908 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe calc.exe PID 908 wrote to memory of 1632 908 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe calc.exe PID 908 wrote to memory of 1240 908 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe notepad.exe PID 908 wrote to memory of 1240 908 ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe"C:\Users\Admin\AppData\Local\Temp\ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\SysWOW64\notepad.exe"3⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe"C:\Users\Admin\AppData\Local\Temp\ab2a89c9b33bd518ea9f1a53cf74283795acaf19218076d78a765fde28d67790.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/860-100-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/860-122-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/860-58-0x0000000000000000-mapping.dmp
-
memory/860-92-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/860-97-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/860-126-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/860-112-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/860-55-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/860-65-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/860-106-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/860-332-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/908-113-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/908-88-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/908-89-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/908-75-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/908-76-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/908-78-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/908-80-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/908-82-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/908-84-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/908-85-0x0000000000410910-mapping.dmp
-
memory/1240-73-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1240-69-0x0000000000000000-mapping.dmp
-
memory/1240-90-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1240-74-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1240-118-0x0000000000270000-0x00000000002BE000-memory.dmpFilesize
312KB
-
memory/1240-72-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1240-71-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1240-334-0x0000000000270000-0x00000000002BE000-memory.dmpFilesize
312KB
-
memory/1240-109-0x0000000000270000-0x00000000002BE000-memory.dmpFilesize
312KB
-
memory/1240-138-0x0000000000270000-0x00000000002BE000-memory.dmpFilesize
312KB
-
memory/1240-127-0x0000000000270000-0x00000000002BE000-memory.dmpFilesize
312KB
-
memory/1428-63-0x00000000002C0000-0x00000000002D3000-memory.dmpFilesize
76KB
-
memory/1428-54-0x0000000075071000-0x0000000075073000-memory.dmpFilesize
8KB
-
memory/1428-91-0x0000000000400000-0x0000000004CC8000-memory.dmpFilesize
72.8MB
-
memory/1428-64-0x0000000000400000-0x0000000004CC8000-memory.dmpFilesize
72.8MB
-
memory/1632-66-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/1632-132-0x00000000001A0000-0x00000000001EE000-memory.dmpFilesize
312KB
-
memory/1632-128-0x00000000001A0000-0x00000000001EE000-memory.dmpFilesize
312KB
-
memory/1632-115-0x00000000001A0000-0x00000000001EE000-memory.dmpFilesize
312KB
-
memory/1632-123-0x00000000001A0000-0x00000000001EE000-memory.dmpFilesize
312KB
-
memory/1632-108-0x00000000001A0000-0x00000000001EE000-memory.dmpFilesize
312KB
-
memory/1632-60-0x0000000000000000-mapping.dmp
-
memory/1632-119-0x00000000001A0000-0x00000000001EE000-memory.dmpFilesize
312KB
-
memory/1632-57-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/1632-333-0x00000000001A0000-0x00000000001EE000-memory.dmpFilesize
312KB
-
memory/1632-102-0x00000000001A0000-0x00000000001EE000-memory.dmpFilesize
312KB
-
memory/1632-335-0x00000000001D8000-0x00000000001DA000-memory.dmpFilesize
8KB